Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a vulnerability. they found a lawyer

dixken.de

Post reply on HN
Print view View original

121–130 of 466 posts

Re: I found a vulnerability. they found a lawyer

#121

Post by chuckadams »

tracker1 wrote: post #95
undebuggable wrote: post #48

> the portal used incrementing numeric user IDs > every account was provisioned with a static default password Hehehe. I failed countless job interviews for mistakes much less serious than that. Yet someone gets the job while making worse mistakes, and there are plenty of such systems on production handling real people's data.

Literally found the same issue in a password system, on top of passwords being clear text in the database... cleared all passwords, expanded the db field to hold a longer hash (pw field was like 12 chars), setup "recover password" feature and emailed all users before End of Day. My own suggestion to anyone reading this... version your password hashing mechanics so you can upgrade hashing methods as needed in the futu…

Several web frameworks, including Rails, Laravel, and Symfony, will automatically upgrade password hashes if the algorithm or work factor has changed since the password was last hashed.

Re: I found a vulnerability. they found a lawyer

#122

Post by psadauskas »

janalsncm wrote: post #71

Three thoughts from someone with no expertise. 1) If you make legal disclosure too hard, the only way you will find out is via criminals. 2) If other industries worked like this, you could sue an architect who discovered a flaw in a skyscraper. The difference is that knowledge of a bad foundation doesn’t inherently make a building more likely to collapse, while knowledge of a cyber vulnerability is an inherent risk.…

Regarding your 2), in other industries and engineering professions, the architect (or civil engineer, or electrical engineer) who signed off carries insurance, and often is licensed by the state.

I absolutely do not want to gatekeep beginners from being able to publish their work on the open internet, but I often wonder if we should require some sort of certification and insurance for large businesses sites that handle personal info or money. There'd be a Certified Professional Software Engineer that has to sign off on it, and thus maybe has the clout to push back on being forced to implement whatever dumb idea an MBA has to drive engagement or short-term sales.

Maybe. Its not like its worked very well lately for Boeing or Volkswagen.

Re: I found a vulnerability. they found a lawyer

#123

Post by jcynix »

czbond wrote: post #74
paxys wrote: post #69

When you are acting in good faith and the person/organization on the other end isn't, you aren't having a productive discussion or negotiation, just wasting your own time. The only sensible approach here would have been to cease all correspondence after their very first email/threat. The nation of Malta would survive just fine without you looking out for them and their online security.

Agree - yet, security researchers and our wider community also needs to recognize that vulnerabilities are foreign to most non-technical users. Cold approach vulnerability reports to non-technical organizations quite frankly scare them. It might be like someone you've never met telling you the door on your back bedroom balcony can be opened with a dummy key, and they know because they tried it. Such organizations don…

> Such organizations don't know what to do.

Maybe they should simply use some common sense? If someone could and would steal valuables, it seems highly unlikely that he/she/it would notify you before doing it.

If they would want to extort you, they would possibly do so early on. And maybe encrypt some data as a "proof of concept" ...

But some organizations seem to think that their lawyers will remedy every failure and that's enough.

Re: I found a vulnerability. they found a lawyer

#124

Post by Onavo »

janalsncm wrote: post #71

Three thoughts from someone with no expertise. 1) If you make legal disclosure too hard, the only way you will find out is via criminals. 2) If other industries worked like this, you could sue an architect who discovered a flaw in a skyscraper. The difference is that knowledge of a bad foundation doesn’t inherently make a building more likely to collapse, while knowledge of a cyber vulnerability is an inherent risk.…

There are jurisdictions (and cultures) where truth is not an absolute defence against defamation. In other words, it's one thing to disclose the issue to the authorities, it's another to go to the press and trumpet it on the internet. The nail that sticks out gets hammered down.

Given that this is Malta in particular, the author probably wants to avoid going there for a bit. It's a country full of organized crime and corruption where people like him would end up with convenient accidents.

Re: I found a vulnerability. they found a lawyer

#125

Post by ipaddr »

Hnrobert42 wrote: post #96

I use a different email address for every service. About 15 years ago, I began getting spam at my diversalertnetwork email address. I emailed DAN to tell them they'd been breached. They responded with an email telling me how to change my password. I guess I should feel lucky they didn't try to have me criminally prosecuted.

That could be a hack or something the company sold to a third party.

Re: I found a vulnerability. they found a lawyer

#126

Post by Onavo »

psadauskas wrote: post #122
janalsncm wrote: post #71

Three thoughts from someone with no expertise. 1) If you make legal disclosure too hard, the only way you will find out is via criminals. 2) If other industries worked like this, you could sue an architect who discovered a flaw in a skyscraper. The difference is that knowledge of a bad foundation doesn’t inherently make a building more likely to collapse, while knowledge of a cyber vulnerability is an inherent risk.…

Regarding your 2), in other industries and engineering professions, the architect (or civil engineer, or electrical engineer) who signed off carries insurance, and often is licensed by the state. I absolutely do not want to gatekeep beginners from being able to publish their work on the open internet, but I often wonder if we should require some sort of certification and insurance for large businesses sites that hand…

Oh there have been many cases where software engineers who are not professional engineers with the engineering mafia designation get sidelined by authorities for lacking standing. We absolutely should get rid of the engineering mafias and unions.

https://ij.org/press-release/oregon-engineer-makes-history-w...

Re: I found a vulnerability. they found a lawyer

#127

Post by BlueGreenMagick »

dekhn wrote: post #112
hbrav wrote: post #86

This is extremely disappointing. The insurer in question has a very good reputation within the dive community for acting in good faith and for providing medical information free of charge to non-members. This sounds like a cultural mismatch with their lawyers. Which is ironic, since the lawyers in question probably thought of themselves as being risk-averse and doing everything possible to protect the organisation's…

I find often that conversations between lawyers and engineers are just two very different minded people talking past each other. I'm an engineer, and once I spent more time understanding lawyers, what they do, and how they do it, my ability to get them to do something increased tremendously. It's like programming in an extremely quirky programming language running on a very broken system that requires a ton of money…

I'm curious to hear your take on the situation in the article.

Based on your experience, do you think there are specific ways the author could have communicated differently to elicit a better response from the lawyers?

Re: I found a vulnerability. they found a lawyer

#128

Post by josephg »

makr17 wrote: post #102
undebuggable wrote: post #48

> the portal used incrementing numeric user IDs > every account was provisioned with a static default password Hehehe. I failed countless job interviews for mistakes much less serious than that. Yet someone gets the job while making worse mistakes, and there are plenty of such systems on production handling real people's data.

Years ago I worked for a company that bought another company. Our QA folks were asked to give their site a once-over. What they found is still the butt of jokes in my circle of friends/former coworkers. * account ids are numeric, and incrementing * included in the URL after login, e.g. ?account=123456 * no authentication on requests after login So anybody moderately curious can just increment to account_id=123457 to…

I did some work ~15 years ago for a consulting company. The company pushes their own custom opensource cms into most projects - built on top of mongodb and written by the ceo. He’s a lovely guy, and good coder. But he’s totally self taught at programming and he has blind spots a mile wide. And he hates having his blind spots pointed out. He came back from a react conference once thinking the react team invented functional programming.

A friend at the company started poking around in the CMS. Turns out the login system worked by giving the user a cookie with the mongodb document id for the user they’re logged in as. Not signed or anything. Just the document id in plain text. Document IDs are (or at least were) mostly sequential, so you could just enumerate document IDs in your cookie to log in as anyone.

The ceo told us it wasn’t actually a security vulnerability. Then insisted we didn’t need to assign a CVE or tell any of our customers and users. He didn’t want to fix the code. Then when pushed he wanted to slip a fix into the next version under the cover of night and not tell anyone. Preferably hidden in a big commit with lots of other stuff.

It’s become a joke between us too. He gives self taught programmers a bad rep. These days whenever I hear a product was architected by someone who’s self taught, I always check how the login system works. It’s often enlightening.

Re: I found a vulnerability. they found a lawyer

#129

Post by DANmode »

nilslindemann wrote: post #116

AFAIK, what this dude did - running a script which tries every password and actually accessing personal data of other people – is illegal in Germany. The reasoning is, just because a door of a car which is not yours is open you have no right to sit inside and start the motor. Even if you just want to honk the horn to inform the guy that he has left the door open. https://www.nilsbecker.de/rechtliche-grauzonen-fuer-et…

Hopefully no criminals turn up to do the illegal thing.

Re: I found a vulnerability. they found a lawyer

#130

Post by refulgentis »

bubblewand wrote: post #46
refulgentis wrote: post #9

Earlier quoted context omitted.

> These are the sort of things that are supposed to lead to commendations and promotions. Maybe I live in fantasyland. I had a bit of a feral journey into tech, poor upbringing => self taught college dropout waiting tables => founded iPad point of sale startup in 2011 => sold it => Google in 2016 to 2023 It was absolutely astounding to go to Google, and find out that all this work to ascend to an Ivy League-esque emp…

I've seen into some moderately high levels of "prestigious" business and government circles and I've yet to find any level at which everyone suddenly becomes as competent and sharp as I'd have expected them to be, as a child and young adult (before I saw what I've seen and learned that the norm is morons and liars running everything and operating terrifically dysfunctional organizations... everywhere, apparently, reg…

Ty for sharing this, I don’t talk about it often, and never in professional circles. There’s a lot of emotions and uncertainty attached to it. It’s very comforting to see someone else describe it as it is to me without being just straightforwardly misanthropic.
Post reply on HN